PT-2026-110661 · Freerdp+1 · Freerdp
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions 2.0.0 through 3.31.0
Description
An insecure permission issue exists in the
winpr-makecert component. The software creates unencrypted private keys without restricting file modes to the owner only. On multi-user Unix hosts, local users can read these world-readable key files or access PFX files protected by a hard-coded default password to steal private keys.Recommendations
Update FreeRDP to version 3.32.0 or later.
Exploit
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp